CVE-2023-45669
Improper signature counter value handling in webauthn4j-spring-security
WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. Affected versions are subject to improper signature counter value handling. A flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work. An attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected. This issue has been addressed in version 0.9.1.RELEASE. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper signature counter value handling in webauthn4j-spring-security
WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. Affected versions are subject to improper signature counter value handling. A flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work. An attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected. This issue has been addressed in version 0.9.1.RELEASE. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-45669- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2023-2816
WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. Affected versions are subject to improper signature counter value handling. A flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work. An attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected. This issue has been addressed in version 0.9.1.RELEASE. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
EUVD-2023-2816- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v9hx-v6vf-g36j
WebAuthn4J Spring Security Improper signature counter value handling
Improper signature counter value handling
Impact
A flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work. An attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected.
Patches
Please upgrade to com.webauthn4j:webauthn4j-spring-security-core:0.9.1.RELEASE
References
For more details about WebAuthn signature counters, see WebAuthn specification 6.1.1. Signature Counter Considerations.
Reporter
This issue was discovered by Michael Budnick (@mbudnick)
- Record
GHSA-v9hx-v6vf-g36j- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. Affected versions are subject to improper signature counter value handling. A flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work. An attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected. This issue has been addressed in version 0.9.1.RELEASE. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-45669- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
Improper signature counter value handling in webauthn4j-spring-security
WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. Affected versions are subject to improper signature counter value handling. A flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work. An attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected. This issue has been addressed in version 0.9.1.RELEASE. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2023-45669- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVGHSA-v9hx-v6vf-g36j
WebAuthn4J Spring Security Improper signature counter value handling
Improper signature counter value handling
Impact
A flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work. An attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected.
Patches
Please upgrade to com.webauthn4j:webauthn4j-spring-security-core:0.9.1.RELEASE
References
For more details about WebAuthn signature counters, see WebAuthn specification 6.1.1. Signature Counter Considerations.
Reporter
This issue was discovered by Michael Budnick (@mbudnick)
- Record
GHSA-v9hx-v6vf-g36j- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.webauthn4j:webauthn4j-spring-security-coreMaven |
before 0.9.1.RELEASE | 0.9.1.RELEASE |
com.webauthn4j:webauthn4j-spring-security-coreMaven |
before 0.9.1.RELEASE, plus listed versions 0.7.0.RELEASE0.7.1.RELEASE0.7.2.RELEASE0.7.3.RELEASE0.7.4.RELEASE Show 4 moreShow less0.7.5.RELEASE0.7.6.RELEASE0.8.0.RELEASE0.9.0.RELEASE |
0.9.1.RELEASE |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-45669 is a medium vulnerability (CVSS 4.8) in Webauthn4j Spring Security, published October 16, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. Fixed in com.webauthn4j:webauthn4j-spring-security-core 0.9.1.RELEASE.
References
github.com/webauthn4j/webauthn4j-spring-security/security/advisories/GHSA-v9hx-v6vf-g36j
w3.org/TR/2021/REC-webauthn-2-20210408
nvd.nist.gov/vuln/detail/CVE-2023-45669